Visitor management for power plants and critical infrastructure in India (2026)

Power plants and critical sites at a glance

Which laws apply to visitors at a power plant or critical site?

• IT Act 2000, section 70. The Government may notify a computer resource that affects critical information infrastructure (CII) as a “protected system”. CII is a computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety. Unauthorised access to a protected system carries up to ten years in jail and a fine (s.70(3)). “Access” here means gaining entry into or communicating with the computer resource (s.2(1)(a)), so the risk at the gate is the visitor who plugs into a protected system. Rules of May 2018 require a CISO and a steering committee for protected systems (S.S. Rana & Co.).
• NCIIPC. A unit of the National Technical Research Organisation, notified under section 70A on 16 January 2014. Its public CII guidelines (version 2.0, January 2015) name power as a critical sector and call for CCTV, swipe badges and access control policies (PC12); “physical authorization at the entry/exit of the CII area”, with further authorisation at sub-department and division level, which it calls multi-tier security access control (IC2); controlled movement of equipment and media, with gate passes for media leaving the site; NDAs across the supply chain; and control of smartphones and USB and other mobile storage devices.
• CERT-In. Its Directions of 28 April 2022, under section 70B, require cyber incidents to be reported within six hours and ICT logs kept for a rolling 180 days in India. CSIRT-Power, set up at the CEA on 5 April 2023, is an extended arm of CERT-In (PIB).

Which systems are notified as protected systems, and any direction NCIIPC has given your organisation, are generally not public. Align the visitor procedure with your security plan, your CISO and the guarding authority.

What the CEA cyber security rules say about physical access

The 2021 Guidelines. The CEA (Cyber Security in Power Sector) Guidelines, released in October 2021, apply to power utilities, load despatch centres and others, and reach integrators, OEMs and vendors. King Stubb & Kasiva calls them advisory. Their most direct reference to physical access is Article 8: annual cyber security training must cover personnel with “authorized cyber or authorized physical access (unescorted or escorted)” to Critical Systems, and no personnel may access a Critical System before completing that training, except in a cyber crisis or emergency. Article 1 asks that data move to or from the internet-facing IT system only through an identifiable whitelisted device, scanned for malware under the site’s SOP.

The 2026 Regulations. The CEA notified the CEA (Cyber Security in Power Sector) Regulations, 2026 on 31 July 2026. They come into force on 1 April 2027, when they replace the 2021 Guidelines (PwC), except six provisions excluded from that date (TeamLease RegTech) and to be notified separately (Beacon Security). Generating companies, captive plants and storage are covered at 50 MW and above (Power Line); transmission and distribution licensees and load despatch centres are covered whatever their size (Beacon Security). Published summaries describe a policy covering access control, remote access and supply chain risk, OT isolated from IT and the internet by default, and a personnel risk assessment covering vendor staff (Beacon Security). We could not read the Gazette text, and no summary we found mentions visitors, escorts or phones, so do not read the framework as mandating a visitor register; check the notified text with your CISO.

ISO 27001, ISO/IEC 27019 and IEC 62443 at energy sites

• ISO/IEC 27001:2022, Annex A 7. Of the fourteen physical controls, 7.1 perimeters, 7.2 physical entry, 7.4 monitoring, 7.6 working in secure areas and 7.10 storage media matter most for visitors. See our ISO 27001 guide.
• ISO/IEC 27019:2024. The second edition (October 2024) builds on ISO/IEC 27002:2022 for systems that control the generation, transmission, storage and distribution of electricity, gas, oil and heat, and the premises that house them, excluding nuclear process control (ISO). It adds four physical controls: 7.15 securing control centres, 7.16 securing equipment rooms, 7.17 securing peripheral sites, and 7.18 interconnected control and communication systems. The CEA’s 2021 Guidelines ask responsible entities to be ISO/IEC 27001 certified, including the sector-specific controls of ISO/IEC 27019 (Article 1(b)).
• IEC 62443. Industrial automation and control system security. Part 2-1:2024 sets asset owners’ programme requirements and removed duplication with an ISMS (IEC); Part 2-4 covers service providers (ISA). We therefore take physical entry controls from the ISMS and ISO/IEC 27019.

CISF, state police or a private agency: who owns the gate?

Under section 14 of the CISF Act 1968, the Director-General may depute the force to a public sector, joint venture or private industrial undertaking at the request, and at the charge, of its managing director. CISF lists power plants and nuclear facilities among the installations it protects. For solar, wind and hybrid projects within 50 km of the border, MHA’s July 2026 clearance guidelines expect security such as anti-drone systems operated by CISF or state police at the developer’s cost, pre-verified project employees and monitoring of foreign nationals (MHA).

The guarding force owns its register and search rules; the plant owns who is invited, to which zone, with which escort. Force standing orders are generally not public, so agree in writing who sends the expected-visitor list, by when, and who can overrule a refusal.

Prohibited places and foreign nationals

Official Secrets Act 1923. Section 2(8)(d) lets the Central Government declare a place used for gas, water or electricity works a “prohibited place” by Gazette notification, with a copy affixed in English and the local language. Section 3 makes it an offence to approach or enter a prohibited place, or make a sketch or note useful to an enemy, for a purpose prejudicial to the State. Do not assume your site is notified; ask legal, and look for the notice at the gate.

Immigration and Foreigners Act 2025. In force since 1 September 2025, it replaced the Foreigners Act 1946 and three other laws (Vialto Partners).

• Restricted places. Section 11 bars a foreigner from entering a protected area, restricted area or prohibited place without a special permit or permission. The Immigration and Foreigners Order 2025 (S.O. 3986(E)) applies this to Official Secrets Act prohibited places, with permission from the civil authority or Registration Officer (para 15); Protected and Restricted Area permits come under para 14.
• Power, water and petroleum. Para 9(2) requires civil authority permission before a foreigner on an employment visa takes employment with a private-sector undertaking supplying power or water, or in petroleum; para 9(5) obliges management to give the civil authority information on foreigners employed; OCI cardholders are exempt (para 9(6)). Whether an OEM’s own engineer on assignment is covered is a question for counsel.
• Accommodation. Section 8 requires keepers of accommodation to report foreign guests; check whether that covers your guest house.

MHA’s border-area guidelines add that developers should not engage engineers or labour from land border countries (they name Pakistan, Bangladesh and China) without Central Government permission.

Day-in-the-life scenarios at a power plant

6:30 am, day one of the annual overhaul. Suresh Patil, the security officer, has 120 contract workers and OEM engineers due at the contractor gate. Maintenance planning sent the approved list by contractor and zone last week; anyone without a safety induction and NDA is not on it. Passes cover the outage window and one zone; two replacement fitters wait for the planning engineer’s approval.

10:15 am, a foreign OEM expert arrives for commissioning. HR has confirmed his visa and any permission the site needs, and he completed the NDA and inductions online before travelling. ID verification happens at the gate, as policy requires for foreign nationals. His laptop and USB media are registered and scanned before he goes near the DCS room, and a named plant engineer escorts him.

11:00 am, an auditor in the control room. A CERT-In empanelled auditor arrives for a cyber security audit with an authorisation letter. Priya Nair, the shift charge engineer, approves entry. Phones stay at the door, an escort stays throughout, and no device is connected without the CISO’s written approval.

2:40 pm, an unannounced visitor asks for the station head. A man tells Ramesh Gond at the main gate he has a meeting with Vikram Sinha, the station head, and offers a number to call. Ramesh rings the office from the staff directory instead. Nobody expects him, so he is politely refused, the refusal is recorded and security checks the watchlist.

Recommended set-up: twelve decisions

1. Zones. Public, administrative, operational, control room and restricted (DCS and SCADA rooms, switchyard, battery and server rooms), with every gate and unmanned site listed.
2. Visitor types. Business visitor, contract worker, OEM engineer, foreign national, auditor or regulator, driver, candidate.
3. Pre-approval chains. The host approves; the zone owner approves restricted zones; HR or legal and the security officer approve foreign nationals. Walk-ins go no further than the visitor room.
4. ID verification where policy calls for it. At least for contract workers, OEM engineers and foreign nationals, matched against the approved list.
5. Inductions and NDAs before arrival. Safety induction, site security rules and the cyber security training your CEA framework expects of people with physical access to Critical Systems.
6. Escorts. A named escort for control rooms and restricted zones, a written ratio for groups, and unescorted access only for inducted contractors in their own zone. In the switchyard and other live areas, the escort should be a person authorised under the plant’s electrical safety rules.
7. Device rules. Phones and cameras deposited before restricted zones; laptops and USB media registered and scanned; photography notices at the gate.
8. Time-bound passes. One gate, one zone and one window (a shift, the outage, the commissioning period), expiring on their own.
9. Live register and roll call. Know who is in each zone now. In an emergency, report anyone unaccounted for to the fire service, including the plant’s own fire station, at once; sweep only if safe; after a real alarm, only the fire officer in charge clears re-entry. See our roll call guide.
10. Watchlist flag. Debarred contractors and people whose access was withdrawn, approved by the head of security, reviewed regularly, shown quietly to the guard.
11. Guard force interface. A written agreement with CISF, police or the agency on lists, timings and escalation.
12. Retention. Keep the visit record and its logs for one year and photos and mobile numbers for days, as a written decision the DPO and counsel sign off (see the last question below). Most duties apply from 13 May 2027 (Rule 1(4)); some firms, including Cyril Amarchand Mangaldas, give 14 May 2027; as of 12 October 2026 no change had been notified (S.S. Rana & Co.). See our DPDP guide.

Common mistakes at power plants and critical sites

• Outage passes that outlive the outage. Workers keep valid passes for weeks after the shutdown.
• Escort in name only. One supervisor “escorting” a group spread across two zones.
• Laptops straight into the DCS room. OEM media nobody registered or scanned.
• Phone rules waived for senior visitors. The control-room rule applies to everyone.
• Keeping everything indefinitely. “Critical infrastructure” is not a retention period under the DPDP Act.
• Contract labour data without a basis. Whether the principal employer can rely on the DPDP employment ground for contract workers is unsettled (PSA Legal); take advice.

Where Orb fits

Orb, our visitor management system, records every approval, pass and exit within the rules your security plan and guarding authority set.

Questions buyers ask